Secret.get does has the Secret's contents in plaintext in the statefile

[mike-chen-samsung]

What happened?

import { Secret } from '@pulumi/kubernetes/core/v1'

Secret.get(...)

If you look at the resource in the statefile, its data will be (encoded) in plaintext under outputs.__inputs.data. This is a security concern! Not only is it unencrypted in state, but it will sometimes show as a diff in pulumi up --diff --refresh

Expected Behavior

As a general rule, I expect that if an outputs.xxx value is encrypted, its corresponding outputs.__inputs.xxx value should be encrypted too

Steps to reproduce

1. Create a Secret

echo 'apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  USER_NAME: YWRtaW4=
  PASSWORD: MWYyZDFlMmU2N2Rm' | kubectl apply -f -

2. In your Pulumi code add Secret.get("mysecret", "default/mysecret")
3. pulumi stack export > state.json
4. Find the secret in the statefile and see that outputs.__inputs.data is unencrypted (though outputs.data is properly encrypted)

Output of pulumi about

CLI          
Version      3.53.1
Go Version   go1.19.5
Go Compiler  gc

Plugins
NAME        VERSION
kubernetes  3.21.3

Host     
OS       darwin
Version  11.6
Arch     x86_64

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[thomas11]

Thank you for the report, @mike-chen-samsung, this sounds indeed concerning. A first glance at the code shows that output.__inputs is supposed to be encrypted.

We'll investigate further today.

[thomas11]

I was able to repro this locally with a default Minikube installation, your instructions above (except stack export instead of state export), and this minimal program:

import * as k8s from "@pulumi/kubernetes";
k8s.core.v1.Secret.get("mysecret", "default/mysecret")

[thomas11]

Hi @mike-chen-samsung, the latest pulumi-kubernetes v3.24.0 has this fixed. Thank you again for reporting it!